apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: tailscale-operator
  namespace: tailscale
spec:
  interval: 1h
  timeout: 15m
  chart:
    spec:
      chart: tailscale-operator
      version: "1.96.x"
      sourceRef:
        kind: HelmRepository
        name: tailscale
        namespace: tailscale
      interval: 12h
  targetNamespace: tailscale
  install:
    createNamespace: true
    crds: Create
  upgrade:
    crds: CreateReplace
  values:
    # Operator configuration
    operatorConfig:
      # Tag to use for pods created by the operator (e.g., tailnet)
      hostname: "tailscale-operator"
      # Auth key via existing secret
      useOAuth: false
      useOIDC: false
      # Concurrency
      tailscaleOperator:
        setConcurrentResourceReconciles: 2
      # PodSecurity "restricted:latest" compliance
      podSecurityContext:
        runAsNonRoot: true
      securityContext:
        allowPrivilegeEscalation: false
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
        capabilities:
          drop:
            - ALL
    # Disable webhook (optional)
    webhook:
      enabled: false